Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Firefox und IE laden zu langsam die webseiten (https://www.trojaner-board.de/101134-firefox-ie-laden-langsam-webseiten.html)

cosinus 11.07.2011 21:33
Zitat:
darf ich jetzt wieder AVG installieren? das windoof defender ding macht mich nicht unbedingt glücklich
Nichts voreilig installieren! Wenn wir mitten in einer Bereinigungsphase sind, macht ein Virenscanner im Hintergrund eh keinen Sinn und von alleine kommen auch keine Viren drauf! Und vergiss nicht dass dein Virenscanner den Befall auch nicht verhindert hat!


Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.


Code:
Regnull::
[HKEY_USERS\S-1-5-21-326891830-3036340036-2452681849-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{000670F7-05A4-819B-DE9B-404A08A846E7}*]
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

chaoskomet 11.07.2011 22:13
okay habe ich gemacht:

Code:
ComboFix 11-07-11.02 - Chaoskomet 11.07.2011  22:57:11.2.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3036.1986 [GMT 2:00]
ausgeführt von:: c:\users\Chaoskomet\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Chaoskomet\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-06-11 bis 2011-07-11  ))))))))))))))))))))))))))))))
.
.
2011-07-11 21:04 . 2011-07-11 21:04        --------        d-----w-        c:\users\Chaoskomet\AppData\Local\temp
2011-07-11 21:04 . 2011-07-11 21:04        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-07-11 17:27 . 2011-07-11 17:27        --------        d-----w-        c:\users\Chaoskomet\AppData\Local\AVG Security Toolbar
2011-07-11 17:04 . 2011-07-11 17:04        --------        d-----w-        c:\users\Chaoskomet\AppData\Roaming\AVG10
2011-07-11 15:32 . 2011-06-20 06:57        7074640        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{6D8DFFEF-D039-448D-A918-F751965894F4}\mpengine.dll
2011-07-11 15:32 . 2011-05-24 17:14        222080        ------w-        c:\windows\system32\MpSigStub.exe
2011-07-11 12:41 . 2011-07-11 12:41        --------        d-----w-        C:\_OTL
2011-07-11 10:29 . 2011-07-11 10:29        --------        d-----w-        c:\users\Chaoskomet\AppData\Local\ABBYY
2011-07-11 10:27 . 2011-07-11 10:28        --------        d-----w-        c:\program files\ABBYY ScanTo Office 1.0
2011-07-11 10:10 . 2011-07-11 10:10        --------        d-----w-        c:\windows\tessdata
2011-07-11 10:10 . 2011-07-11 10:10        --------        d-----w-        c:\program files\Softi Software
2011-07-11 10:08 . 2011-07-11 10:08        --------        d-----w-        c:\users\Chaoskomet\AppData\Roaming\Softi Software
2011-07-11 10:02 . 2011-07-11 10:10        --------        d-----w-        c:\users\Chaoskomet\AppData\Roaming\GetRightToGo
2011-07-11 09:40 . 2011-07-11 09:40        --------        d-----w-        c:\users\Chaoskomet\AppData\Roaming\Malwarebytes
2011-07-11 09:40 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-11 09:40 . 2011-07-11 09:40        --------        d-----w-        c:\programdata\Malwarebytes
2011-07-11 09:40 . 2011-05-29 07:11        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-07-11 09:40 . 2011-07-11 09:40        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-07-09 20:05 . 2011-07-09 20:05        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-08 21:22 . 2011-07-08 21:22        --------        d-----w-        c:\program files\ESET
2011-07-05 12:10 . 2011-06-21 17:11        17712        ----a-w-        c:\windows\system32\nitrolocalui2.dll
2011-07-05 12:10 . 2011-06-21 17:11        26416        ----a-w-        c:\windows\system32\nitrolocalmon2.dll
2011-07-05 12:10 . 2011-07-05 12:10        --------        d-----w-        c:\program files\Nitro PDF
2011-07-05 12:10 . 2011-07-05 12:10        --------        d-----w-        c:\program files\Common Files\Nitro PDF
2011-06-30 08:54 . 2011-06-30 08:54        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help
2011-06-29 16:46 . 2011-06-29 16:51        --------        d-----w-        c:\users\Chaoskomet\AppData\Roaming\Audacity
2011-06-29 10:58 . 2011-04-29 15:59        276992        ----a-w-        c:\windows\system32\schannel.dll
2011-06-29 06:27 . 2011-06-29 06:27        --------        d-----w-        c:\users\Chaoskomet\AppData\Local\HP
2011-06-28 09:57 . 2011-06-29 06:27        --------        d-----w-        c:\users\Chaoskomet\AppData\Roaming\HP
2011-06-28 09:57 . 2011-06-28 09:57        --------        d-----w-        c:\programdata\WEBREG
2011-06-28 09:52 . 2011-06-28 09:52        --------        d-----w-        c:\programdata\HP Product Assistant
2011-06-27 07:50 . 2011-06-27 07:50        --------        d-----w-        c:\program files\Common Files\HP
2011-06-27 07:50 . 2011-06-27 07:50        --------        d-----w-        c:\program files\Hewlett-Packard
2011-06-27 07:50 . 2011-06-27 07:50        --------        d-----w-        c:\program files\Common Files\Hewlett-Packard
2011-06-27 07:50 . 2011-06-27 07:50        --------        d-----w-        c:\programdata\Hewlett-Packard
2011-06-27 07:50 . 2007-10-20 16:21        278016        ----a-w-        c:\windows\system32\Spool\prtprocs\w32x86\hpzpp5mu.dll
2011-06-27 07:48 . 2007-10-20 16:25        118272        ----a-w-        c:\windows\system32\hpz3l5mu.dll
2011-06-27 07:48 . 2011-06-29 20:39        --------        d-----w-        c:\program files\HP
2011-06-27 07:47 . 2011-06-28 09:53        --------        d-----w-        c:\programdata\HP
2011-06-27 07:47 . 2008-01-25 12:23        271704        ----a-w-        c:\windows\system32\hpzids01.dll
2011-06-27 07:47 . 2008-01-25 12:22        729088        ----a-w-        c:\windows\system32\hpowiax7.dll
2011-06-27 07:47 . 2008-01-25 12:22        303104        ----a-w-        c:\windows\system32\hpovst15.dll
2011-06-27 07:47 . 2008-01-25 12:22        581632        ----a-w-        c:\windows\system32\hpotscl6.dll
2011-06-27 07:47 . 2008-01-25 12:22        372736        ----a-w-        c:\windows\system32\hppldcoi.dll
2011-06-21 15:01 . 2011-07-11 11:02        --------        d-----w-        c:\program files\CPUCooL
2011-06-20 12:37 . 2011-06-20 12:37        --------        d-----w-        c:\programdata\CyberLink
2011-06-20 12:37 . 2011-06-20 12:37        --------        d-----w-        c:\users\Public\CyberLink
2011-06-18 14:18 . 2011-06-18 14:18        --------        d-----w-        c:\windows\Sun
2011-06-18 14:18 . 2011-06-18 14:18        --------        d-----w-        c:\program files\Common Files\Java
2011-06-16 12:45 . 2011-04-25 15:29        141104        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll
2011-06-16 12:45 . 2011-04-22 23:25        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2011-06-16 12:45 . 2011-04-22 23:35        1797632        ----a-w-        c:\windows\system32\jscript9.dll
2011-06-16 06:00 . 2011-04-14 14:59        75264        ----a-w-        c:\windows\system32\drivers\dfsc.sys
2011-06-16 06:00 . 2011-04-21 13:58        273408        ----a-w-        c:\windows\system32\drivers\afd.sys
2011-06-16 06:00 . 2011-04-29 13:25        146432        ----a-w-        c:\windows\system32\drivers\srv2.sys
2011-06-16 06:00 . 2011-04-29 13:25        102400        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2011-06-16 06:00 . 2010-12-20 16:35        563712        ----a-w-        c:\windows\system32\oleaut32.dll
2011-06-16 06:00 . 2011-05-02 17:16        739328        ----a-w-        c:\windows\system32\inetcomm.dll
2011-06-16 06:00 . 2011-04-29 13:24        214016        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys
2011-06-16 06:00 . 2011-04-29 13:24        79872        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys
2011-06-16 06:00 . 2011-04-29 13:24        106496        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
2011-06-16 06:00 . 2011-05-02 12:02        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-30 12:02 . 2011-05-30 12:02        37920        ----a-w-        c:\windows\system32\drivers\tbhsd.sys
2011-05-29 11:29 . 2011-05-29 11:29        0        ----a-w-        c:\windows\system32\ConduitEngine.tmp
2011-05-04 02:52 . 2011-03-13 13:35        472808        ----a-w-        c:\windows\system32\deployJava1.dll
2011-04-25 12:42 . 2007-10-25 15:26        5632        ----a-w-        c:\windows\system32\drivers\StarOpen.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{dcea9ff9-5c31-40ac-9285-9c25ff04b93a}"= "c:\program files\produkttests\prxtbpro0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{dcea9ff9-5c31-40ac-9285-9c25ff04b93a}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54        175912        ----a-w-        c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dcea9ff9-5c31-40ac-9285-9c25ff04b93a}]
2011-01-17 14:54        175912        ----a-w-        c:\program files\produkttests\prxtbpro0.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{dcea9ff9-5c31-40ac-9285-9c25ff04b93a}"= "c:\program files\produkttests\prxtbpro0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{dcea9ff9-5c31-40ac-9285-9c25ff04b93a}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DCEA9FF9-5C31-40AC-9285-9C25FF04B93A}"= "c:\program files\produkttests\prxtbpro0.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{dcea9ff9-5c31-40ac-9285-9c25ff04b93a}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2011-03-11 160592]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2011-04-05 353736]
"Remote Control Editor"="c:\program files\Common Files\TerraTec\Remote\TTTvRc.exe" [2010-12-01 1709128]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2011-06-24 2423608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-12 61440]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-02-13 6814240]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1049896]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-02-13 1833504]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-12-23 114688]
"GfK-WatchDog"="c:\program files\GfKLSPService\GfK-WatchDog.exe" [2010-08-29 60928]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-11 752168]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ewsercd;Huawei DataCard USB Serial Port;c:\windows\system32\DRIVERS\ewsercd.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2011-04-07 13224]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-12-27 31124344]
R3 optousb;OPTO ELECTRONICS optousb;c:\windows\system32\DRIVERS\optousb.sys [2009-08-26 18432]
R3 optovcm;OPTO ELECTRONICS optovcm;c:\windows\system32\DRIVERS\optovcm.sys [2009-08-26 26368]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-09-17 535552]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-04-20 152064]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2010-04-27 98432]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2010-04-27 14848]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2010-04-27 123648]
R3 TTHID;Cinergy Hybrid-Stick HID service;c:\windows\system32\DRIVERS\Cinergy_Hybrid-Stick_HID.sys [2009-11-04 23104]
R3 UDXTTM6010;Cinergy Hybrid-Stick BDA service;c:\windows\system32\DRIVERS\UDXTTM6010.sys [2009-11-04 763584]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 ntiomin;ntiomin; [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-04 238952]
S2 GfK-Reporting-Service;GfK-Reporting-Service;c:\program files\GfK Internet-Monitor\GfK-Reporting.exe [2011-01-20 102400]
S2 GfK-Update-Service;GfK-Update-Service;c:\program files\GfK Internet-Monitor\GfK-Updater.exe [2011-01-20 180224]
S2 GfkLSPService;GfkLSPService;c:\program files\GfKLSPService\GfKLSPService.exe [2010-11-17 3506176]
S2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\system32\DRIVERS\kmdfmemio.sys [2008-08-12 13312]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\program files\Nitro PDF\Reader\NitroPDFReaderDriverService2.exe [2011-06-21 196912]
S2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296]
S2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [2010-09-03 185640]
S2 yksvc;Marvell Yukon Service;c:\windows\System32\svchost.exe [2008-01-21 21504]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2008-07-31 29736]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]
S3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\Drivers\VMC326.sys [2008-11-21 238464]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - FSUSBEXDISK
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
yksvcs        REG_MULTI_SZ          yksvc
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt        REG_MULTI_SZ          hpqcxs08
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://mystart.incredimail.com/mb57
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: RF - Formular ausfüllen - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RF - Formular speichern - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: RF - Menü anpassen - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: RF - RoboForm-Leiste ein/aus - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: c:\windows\system32\GfKLSPService.DLL
TCP: DhcpNameServer = 192.168.178.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
FF - ProfilePath - c:\users\Chaoskomet\AppData\Roaming\Mozilla\Firefox\Profiles\ajzdxrw5.default\
FF - prefs.js: browser.startup.homepage - hxxp://mystart.incredimail.com/mb57|hxxp://www.ichbin.nikonwelt.at/galerie/beitrag/4475|hxxp://www.spielesite.com/|https://login.yahoo.com/config/mail?.intl=de&.done=http%3A%2F%2Fde.mg40.mail.yahoo.com%2Fdc%2Flaunch%3F.rand%3D2ob06o83orpl6
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: AI Roboform Toolbar for Firefox: {22119944-ED35-4ab1-910B-E619EA06A115} - c:\program files\Siber Systems\AI RoboForm\Firefox
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: GfK Internet-Monitor: gacela2@nurago.com - c:\program files\GfK Internet-Monitor
FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\AVG\AVG10\Firefox4
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: Bigpoint Games DE Community Toolbar: {0e3dbc69-a682-48da-84e1-82c63a5d678e} - %profile%\extensions\{0e3dbc69-a682-48da-84e1-82c63a5d678e}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - %profile%\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Ext: Modify Headers: {b749fc7c-e949-447f-926c-3f4eed6accfe} - %profile%\extensions\{b749fc7c-e949-447f-926c-3f4eed6accfe}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-07-11 23:04
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(4296)
c:\windows\system32\btmmhook.dll
.
Zeit der Fertigstellung: 2011-07-11  23:07:18
ComboFix-quarantined-files.txt  2011-07-11 21:07
ComboFix2.txt  2011-07-11 15:22
.
Vor Suchlauf: 8.929.185.792 Bytes frei
Nach Suchlauf: 8.596.529.152 Bytes frei
.
- - End Of File - - 95388486549237987073494202A412BD
was muss ich jetzt noch machen?

was hat combo jetzt eigentlich gemacht?

cosinus 11.07.2011 22:18
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

chaoskomet 11.07.2011 23:06
der gmer log erstmal:

Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-07-12 00:04:59
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AC1
Running: gvd0bmdb.exe; Driver: C:\Users\CHAOSK~1\AppData\Local\Temp\aftcypow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          C:\Windows\system32\DRIVERS\atikmdag.sys                                                            section is writeable [0x8EC04000, 0x258606, 0xE8000020]

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [740B7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                [7410A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]            [740BBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]      [740AF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                [740B75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [740AE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [740E8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]    [740BDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]            [740AFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [740AFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]              [740A71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]      [7413CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [740DC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]            [740AD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                      [740A6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [740A687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3460] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]        [740B2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device          \Driver\BTHUSB \Device\00000070                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\BTHUSB \Device\00000070                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\BTHUSB \Device\00000072                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\BTHUSB \Device\00000072                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e276d4                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e276d8                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e2770b                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e279d5                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0c6076dbc066                         
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002269e276d4 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002269e276d8 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002269e2770b (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002269e279d5 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0c6076dbc066 (not active ControlSet)     

---- EOF - GMER 1.0.15 ----

chaoskomet 11.07.2011 23:14
osam:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 00:12:05 on 12.07.2011

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.18

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"BrnStiCp.cpl" - "Brother Industries,Ltd." - C:\Windows\system32\BrnStiCp.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLCFG32.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"aftcypow" (aftcypow) - ? - C:\Users\CHAOSK~1\AppData\Local\Temp\aftcypow.sys  (Hidden registry entry, rootkit activity | File not found)
"catchme" (catchme) - ? - C:\Users\CHAOSK~1\AppData\Local\Temp\catchme.sys  (File not found)
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\Windows\System32\Drivers\ElbyCDIO.sys
"FsUsbExDisk" (FsUsbExDisk) - ? - C:\Windows\system32\FsUsbExDisk.SYS  (File found, but it contains no detailed information)
"Huawei DataCard USB Modem and USB Serial" (hwdatacard) - ? - C:\Windows\System32\DRIVERS\ewusbmdm.sys  (File not found)
"Huawei DataCard USB Serial Port" (ewsercd) - ? - C:\Windows\System32\DRIVERS\ewsercd.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\system32\drivers\IpInIp.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\system32\drivers\NwlnkFlt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\system32\drivers\NwlnkFwd.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"MBAMSwissArmy" (MBAMSwissArmy) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbamswissarmy.sys
"ntiomin" (ntiomin) - ? - C:\Windows\system32\drivers\ntiomin.sys
"ntiopnp" (ntiopnp) - ? - C:\Windows\system32\drivers\ntiopnp.sys
"Tunebite High-Speed Dubbing" (tbhsd) - "RapidSolution Software AG" - C:\Windows\System32\drivers\tbhsd.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{F2DDE6B2-9684-4A55-86D4-E255E237B77C} "avgsecuritytoolbar" - ? - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll  (File not found)
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{0DE76E1C-40C5-4fae-A59A-44EF606A0B02} "AbbyyS2O.S2OShellExtension.1" - "ABBYY (BIT Software)" - C:\Program Files\ABBYY ScanTo Office 1.0\STOShellExtension.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Arbeitsbereiche" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLSHEXT.DLL
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{B7056B8E-4F99-44f8-8CBD-282390FE5428} "VirtualCloneDrive Shell Extension" - "Elaborate Bytes AG" - C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
EzCddax extension "{37DDAAA7-7B07-4e1e-8CFF-B46B63AF2925}" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{4A62FAC4-1670-430B-8C6B-9C7B53F51798} "GfK Internet-Monitor" - ? - C:\Program Files\GfK Internet-Monitor\Gacela2.dll
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&RoboForm" - "Siber Systems Inc." - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "produkttests Toolbar" - "Conduit Ltd." - C:\Program Files\produkttests\prxtbpro0.dll
<binary data> "TerraTec Home Cinema" - "TerraTec Electronic GmbH" - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{dcea9ff9-5c31-40ac-9285-9c25ff04b93a} "produkttests Toolbar" - "Conduit Ltd." - C:\Program Files\produkttests\prxtbpro0.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
"Ausfüllen" - ? - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
{80A21664-E813-4F79-B965-2058C0F7A84C} "ClsidExtension" - ? - C:\Program Files\GfK Internet-Monitor\Gacela2.dll
"RoboForm" - ? - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
"Speichern" - ? - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&RoboForm" - "Siber Systems Inc." - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
{dcea9ff9-5c31-40ac-9285-9c25ff04b93a} "produkttests Toolbar" - "Conduit Ltd." - C:\Program Files\produkttests\prxtbpro0.dll
{AD6E6555-FB2C-47D4-8339-3E2965509877} "TerraTec Home Cinema" - "TerraTec Electronic GmbH" - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{30F9B915-B755-4826-820B-08FBA6BD249D} "Conduit Engine " - "Conduit Ltd." - C:\Program Files\ConduitEngine\prxConduitEngine.dll
{4BEEA052-726D-4A6E-B65D-A6BD07C263F3} "GfK Internet-Monitor" - ? - C:\Program Files\GfK Internet-Monitor\Gacela2.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
{dcea9ff9-5c31-40ac-9285-9c25ff04b93a} "produkttests Toolbar" - "Conduit Ltd." - C:\Program Files\produkttests\prxtbpro0.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} "{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}" - ? -  (File not found | COM-object registry key not found)
{724d43a9-0d85-11d4-9908-00400523e39a} "{724d43a9-0d85-11d4-9908-00400523e39a}" - "Siber Systems Inc." - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Chaoskomet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"BTTray.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"AutoStartNPSAgent" - "Samsung Electronics Co., Ltd." - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
"ccleaner" - "Piriform Ltd" - "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
"IncrediMail" - "IncrediMail, Ltd." - C:\Program Files\IncrediMail\bin\IncMail.exe /c
"msnmsgr" - "Microsoft Corporation" - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
"Remote Control Editor" - "Elgato Systems" - "C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe"
"RoboForm" - "Siber Systems" - "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"BCSSync" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
"BrMfcWnd" - "Brother Industries, Ltd." - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
"ControlCenter3" - "Brother Industries, Ltd." - C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
"GfK-WatchDog" - "GfK" - C:\Program Files\GfKLSPService\GfK-WatchDog.exe /Debug
"HP Software Update" - "Hewlett-Packard" - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"UCam_Menu" - "CyberLink Corp." - "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"
"VirtualCloneDrive" - "Elaborate Bytes AG" - "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Nitro PDF Port Monitor" - "Nitro PDF Software" - C:\Windows\system32\nitrolocalmon2.dll
"PCL hpz3l5mu" - "Hewlett-Packard Company" - C:\Windows\system32\hpz3l5mu.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Program Files\Nero\Update\NASvc.exe,-200" (NAUpdate) - "Nero AG" - C:\Program Files\Nero\Update\NASvc.exe
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
"FsUsbExService" (FsUsbExService) - "Teruten" - C:\Windows\system32\FsUsbExService.Exe
"GfK-Reporting-Service" (GfK-Reporting-Service) - ? - C:\Program Files\GfK Internet-Monitor\GfK-Reporting.exe
"GfK-Update-Service" (GfK-Update-Service) - ? - C:\Program Files\GfK Internet-Monitor\GfK-Updater.exe
"GfkLSPService" (GfkLSPService) - "nurago GmbH" - C:\Program Files\GfKLSPService\GfKLSPService.exe
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"NitroPDFReaderDriverCreatorReadSpool2" (NitroReaderDriverReadSpool2) - "Nitro PDF Software" - C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService2.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"Rezip" (Rezip) - ? - C:\Windows\SYSTEM32\Rezip.exe
"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
"Sony Ericsson PCCompanion" (Sony Ericsson PCCompanion) - "Avanquest Software" - C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe
"SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"SQL Server-Browser" (SQLBrowser) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
"TeamViewer 4" (TeamViewer4) - "TeamViewer GmbH" - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - ? - C:\Windows\SHEBA_~1.SCR  (File not found)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"GacelaLSP" - "nurago GmbH" - C:\Windows\system32\GfKLSPService.DLL

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
MBR:

Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows Vista Home Premium Edition
Windows Information:                Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:        SAMSUNG ELECTRONICS CO., LTD.
BIOS Manufacturer:                Phoenix Technologies Ltd.
System Manufacturer:                SAMSUNG ELECTRONICS CO., LTD.
System Product Name:                R520/R522/R620
Logical Drives Mask:                0x000000b4

Kernel Drivers (total 153):
  0x8241E000 \SystemRoot\system32\ntoskrnl.exe
  0x827C9000 \SystemRoot\system32\hal.dll
  0x8A001000 \SystemRoot\system32\kdcom.dll
  0x8A008000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x8A078000 \SystemRoot\system32\PSHED.dll
  0x8A089000 \SystemRoot\system32\BOOTVID.dll
  0x8A091000 \SystemRoot\system32\CLFS.SYS
  0x8A0D2000 \SystemRoot\system32\CI.dll
  0x8A1B2000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x8A22E000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8A23B000 \SystemRoot\system32\drivers\acpi.sys
  0x8A281000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x8A28A000 \SystemRoot\system32\drivers\msisadrv.sys
  0x8A292000 \SystemRoot\system32\drivers\pci.sys
  0x8A2B9000 \SystemRoot\System32\drivers\partmgr.sys
  0x8A2C8000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x8A2CB000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x8A2D5000 \SystemRoot\system32\drivers\volmgr.sys
  0x8A2E4000 \SystemRoot\System32\drivers\volmgrx.sys
  0x8A32E000 \SystemRoot\System32\drivers\mountmgr.sys
  0x8A401000 \SystemRoot\system32\DRIVERS\iaStor.sys
  0x8A4DC000 \SystemRoot\system32\drivers\atapi.sys
  0x8A4E4000 \SystemRoot\system32\drivers\ataport.SYS
  0x8A502000 \SystemRoot\system32\drivers\msahci.sys
  0x8A50C000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x8A51A000 \SystemRoot\system32\drivers\fltmgr.sys
  0x8A54C000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8A55C000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8A5CD000 \SystemRoot\system32\drivers\ndis.sys
  0x8A6D8000 \SystemRoot\system32\drivers\msrpc.sys
  0x8A703000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8A809000 \SystemRoot\System32\drivers\tcpip.sys
  0x8A8F3000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8A90E000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8AA1E000 \SystemRoot\system32\drivers\volsnap.sys
  0x8AA57000 \SystemRoot\System32\Drivers\spldr.sys
  0x8AA5F000 \SystemRoot\System32\Drivers\mup.sys
  0x8AA6E000 \SystemRoot\System32\drivers\ecache.sys
  0x8AA95000 \SystemRoot\system32\drivers\disk.sys
  0x8AAA6000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x8AAC7000 \SystemRoot\system32\drivers\crcdisk.sys
  0x8ABB8000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8ABC3000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x8EC03000 \SystemRoot\system32\DRIVERS\atikmdag.sys
  0x8F085000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8F125000 \SystemRoot\System32\drivers\watchdog.sys
  0x8F131000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8F1BE000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0x8F1C9000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8F207000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8F216000 \SystemRoot\system32\DRIVERS\athr.sys
  0x8F305000 \SystemRoot\system32\DRIVERS\yk60x86.sys
  0x8F355000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8F359000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8F36C000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8F377000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8F3A7000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8F3A9000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8F3B4000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8F3CC000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x8ABCC000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8A73E000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8F3DB000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8F3E6000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8A77F000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8A78A000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8A7AD000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8A7BC000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8A7D0000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8A7E5000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8A33E000 \SystemRoot\system32\DRIVERS\VClone.sys
  0x8A34A000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
  0x8F3FD000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8A370000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8A7F5000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8A39A000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8A3A7000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8A3DC000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x9080D000 \SystemRoot\system32\drivers\HdAudio.sys
  0x9084C000 \SystemRoot\system32\drivers\portcls.sys
  0x90879000 \SystemRoot\system32\drivers\drmk.sys
  0x9089E000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x90AD5000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x90ADE000 \SystemRoot\System32\Drivers\Null.SYS
  0x90AE5000 \SystemRoot\System32\Drivers\Beep.SYS
  0x90AF5000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x90AFC000 \SystemRoot\System32\drivers\vga.sys
  0x90B08000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x90B29000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x90B31000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x90B39000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x90B44000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x90B52000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x90B5B000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x90B71000 \SystemRoot\system32\DRIVERS\smb.sys
  0x90B85000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x90BB7000 \SystemRoot\system32\drivers\afd.sys
  0x90800000 \SystemRoot\system32\drivers\ws2ifsl.sys
  0x90409000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x9041F000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x9042D000 \SystemRoot\System32\Drivers\ntiomin.SYS
  0x90430000 \SystemRoot\System32\Drivers\ntiopnp.SYS
  0x90438000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x9044B000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x90487000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x90491000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
  0x9049B000 \SystemRoot\System32\Drivers\dfsc.sys
  0x904B2000 \SystemRoot\System32\Drivers\VMC326.sys
  0x904ED000 \SystemRoot\System32\Drivers\BTHUSB.sys
  0x904FA000 \SystemRoot\System32\Drivers\bthport.sys
  0x9057A000 \SystemRoot\system32\DRIVERS\KMWDFILTER.sys
  0x90583000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x9058C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x9059C000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x905A4000 \SystemRoot\system32\DRIVERS\rfcomm.sys
  0x905CD000 \SystemRoot\system32\DRIVERS\BthEnum.sys
  0x905D7000 \SystemRoot\system32\DRIVERS\bthpan.sys
  0x905F1000 \SystemRoot\system32\drivers\btwavdt.sys
  0x90662000 \SystemRoot\system32\drivers\btwaudio.sys
  0x906E2000 \SystemRoot\system32\DRIVERS\btwl2cap.sys
  0x906EC000 \SystemRoot\system32\DRIVERS\btwrchid.sys
  0x906EF000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x906FC000 \SystemRoot\System32\Drivers\dump_iaStor.sys
  0x9CC00000 \SystemRoot\System32\win32k.sys
  0x907D7000 \SystemRoot\System32\drivers\Dxapi.sys
  0x907E1000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x9CE20000 \SystemRoot\System32\TSDDD.dll
  0x9CE40000 \SystemRoot\System32\cdd.dll
  0x8AAD0000 \SystemRoot\system32\drivers\luafv.sys
  0x907F0000 \SystemRoot\system32\DRIVERS\kmdfmemio.sys
  0x8AAEB000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x8AAFB000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x8AB25000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x8AB2F000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x81C0B000 \SystemRoot\system32\drivers\spsys.sys
  0x81CBB000 \SystemRoot\system32\drivers\HTTP.sys
  0x81D28000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x81D45000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x81D5E000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x81D73000 \SystemRoot\system32\drivers\mrxdav.sys
  0x81D94000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x81DB3000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x81DEC000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x81E04000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x81E2C000 \SystemRoot\System32\DRIVERS\srv.sys
  0x81E93000 \SystemRoot\system32\drivers\peauth.sys
  0x81F71000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x81F7B000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x81F87000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x81F9F000 \??\C:\Windows\system32\FsUsbExDisk.SYS
  0x81FA8000 \??\C:\Windows\system32\drivers\mbam.sys
  0x81FAC000 \??\C:\Users\CHAOSK~1\AppData\Local\Temp\aftcypow.sys
  0x77510000 \Windows\System32\ntdll.dll

Processes (total 84):
      0 System Idle Process
      4 SYSTEM
    528 C:\Windows\System32\smss.exe
    596 csrss.exe
    652 C:\Windows\System32\wininit.exe
    672 csrss.exe
    704 C:\Windows\System32\services.exe
    720 C:\Windows\System32\lsass.exe
    732 C:\Windows\System32\lsm.exe
    864 C:\Windows\System32\svchost.exe
    928 C:\Windows\System32\svchost.exe
    1020 C:\Windows\System32\Ati2evxx.exe
    1036 C:\Windows\System32\svchost.exe
    1064 C:\Windows\System32\svchost.exe
    1092 C:\Windows\System32\svchost.exe
    1160 C:\Windows\System32\audiodg.exe
    1176 C:\Windows\System32\svchost.exe
    1192 C:\Windows\System32\SLsvc.exe
    1244 C:\Windows\System32\winlogon.exe
    1296 C:\Windows\System32\svchost.exe
    1436 C:\Windows\System32\svchost.exe
    1476 C:\Windows\System32\svchost.exe
    1776 C:\Windows\System32\spoolsv.exe
    1784 C:\Windows\System32\taskeng.exe
    1816 C:\Windows\System32\svchost.exe
    2016 C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    2032 C:\Windows\System32\agrsmsvc.exe
    236 C:\Windows\System32\svchost.exe
    304 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    456 C:\Windows\System32\FsUsbExService.Exe
    780 C:\Program Files\GfK Internet-Monitor\GfK-Reporting.exe
    664 C:\Program Files\GfK Internet-Monitor\GfK-Updater.exe
    1888 C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    2188 C:\Program Files\Nero\Update\NASvc.exe
    2208 C:\Windows\System32\svchost.exe
    2236 C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService2.exe
    2312 C:\Windows\System32\svchost.exe
    2348 C:\Windows\System32\svchost.exe
    2396 C:\Windows\System32\Ati2evxx.exe
    2420 C:\Windows\System32\Rezip.exe
    2488 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    2512 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    2588 C:\Windows\System32\svchost.exe
    2680 C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
    2712 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    2904 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    3428 C:\Windows\System32\dwm.exe
    3460 C:\Windows\explorer.exe
    3588 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
    3600 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    3676 C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
    3692 C:\Program Files\GfKLSPService\GfK-WatchDog.exe
    3700 C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    3716 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    3724 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    3732 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    3740 C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
    3764 C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe
    3772 C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
    3780 C:\Program Files\Windows Media Player\wmpnscfg.exe
    3796 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    3916 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    2392 C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
    1288 C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
    3368 C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe
    1680 C:\Windows\System32\taskeng.exe
    3828 C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
    1344 C:\Windows\System32\taskeng.exe
    3092 C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
    2804 C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
    4120 C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
    4408 WmiPrvSE.exe
    4900 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    5808 C:\Program Files\Windows Media Player\wmpnetwk.exe
    6052 C:\Windows\System32\svchost.exe
    4184 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    3444 C:\Program Files\GfKLSPService\GfKLSPService.exe
    2132 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    7112 C:\Program Files\Mozilla Firefox\firefox.exe
    7160 C:\Program Files\Mozilla Firefox\plugin-container.exe
    5340 dllhost.exe
    5848 dllhost.exe
    6636 C:\Users\Chaoskomet\Desktop\MBRCheck.exe
    7656 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`40100000  (NTFS)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000026`c5a00000  (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHM320II, Rev: 2AC101C4

      Size  Device Name          MBR Status
  --------------------------------------------
    298 GB  \\.\PhysicalDrive0  Unknown MBR code
            SHA1: 90AE6712C96E547F52E3EBE382852AA331FA41FC


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
nun bin ich ja mal gepsannt wie es weiter geht. :kaffee:

cosinus 11.07.2011 23:49
Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Vista installiert?
Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten)

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.

chaoskomet 11.07.2011 23:54
warum was ist denn los? wenn ich fragen darf.

das werde ich morgen, oder bessergesagt heute mittag machen.

müsste jetzt langsam ins bett, muss morgen früh raus.

ich bedank mich für deine hilfe, und die geduld. :abklatsch:

cosinus 11.07.2011 23:56
Zitat:
298 GB \\.\PhysicalDrive0 Unknown MBR code
Das ist los. Unbekannter MBR ist für mich Sorge genug.

chaoskomet 12.07.2011 00:26
ging ja doch schneller mit laden und brennen als ich dachte - mbr:

Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows Vista Home Premium Edition
Windows Information:                Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:        SAMSUNG ELECTRONICS CO., LTD.
BIOS Manufacturer:                Phoenix Technologies Ltd.
System Manufacturer:                SAMSUNG ELECTRONICS CO., LTD.
System Product Name:                R520/R522/R620
Logical Drives Mask:                0x000000b4

Kernel Drivers (total 153):
  0x8241C000 \SystemRoot\system32\ntoskrnl.exe
  0x827C7000 \SystemRoot\system32\hal.dll
  0x8A00D000 \SystemRoot\system32\kdcom.dll
  0x8A014000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x8A084000 \SystemRoot\system32\PSHED.dll
  0x8A095000 \SystemRoot\system32\BOOTVID.dll
  0x8A09D000 \SystemRoot\system32\CLFS.SYS
  0x8A0DE000 \SystemRoot\system32\CI.dll
  0x8A1BE000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x8A23A000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8A247000 \SystemRoot\system32\drivers\acpi.sys
  0x8A28D000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x8A296000 \SystemRoot\system32\drivers\msisadrv.sys
  0x8A29E000 \SystemRoot\system32\drivers\pci.sys
  0x8A2C5000 \SystemRoot\System32\drivers\partmgr.sys
  0x8A2D4000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x8A2D7000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x8A2E1000 \SystemRoot\system32\drivers\volmgr.sys
  0x8A2F0000 \SystemRoot\System32\drivers\volmgrx.sys
  0x8A33A000 \SystemRoot\System32\drivers\mountmgr.sys
  0x8A409000 \SystemRoot\system32\DRIVERS\iaStor.sys
  0x8A4E4000 \SystemRoot\system32\drivers\atapi.sys
  0x8A4EC000 \SystemRoot\system32\drivers\ataport.SYS
  0x8A50A000 \SystemRoot\system32\drivers\msahci.sys
  0x8A514000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x8A522000 \SystemRoot\system32\drivers\fltmgr.sys
  0x8A554000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8A564000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8A5D5000 \SystemRoot\system32\drivers\ndis.sys
  0x8A6E0000 \SystemRoot\system32\drivers\msrpc.sys
  0x8A70B000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8A80D000 \SystemRoot\System32\drivers\tcpip.sys
  0x8A8F7000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8A912000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8AA22000 \SystemRoot\system32\drivers\volsnap.sys
  0x8AA5B000 \SystemRoot\System32\Drivers\spldr.sys
  0x8AA63000 \SystemRoot\System32\Drivers\mup.sys
  0x8AA72000 \SystemRoot\System32\drivers\ecache.sys
  0x8AA99000 \SystemRoot\system32\drivers\disk.sys
  0x8AAAA000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x8AACB000 \SystemRoot\system32\drivers\crcdisk.sys
  0x8ABBC000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8ABC7000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x8E803000 \SystemRoot\system32\DRIVERS\atikmdag.sys
  0x8EC85000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8ED25000 \SystemRoot\System32\drivers\watchdog.sys
  0x8ED31000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8EDBE000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0x8EDC9000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8EE07000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8EE16000 \SystemRoot\system32\DRIVERS\athr.sys
  0x8EF05000 \SystemRoot\system32\DRIVERS\yk60x86.sys
  0x8EF55000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8EF59000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8EF6C000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8EF77000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8EFA7000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8EFA9000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8EFB4000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8EFCC000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x8ABD0000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8A746000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8EFDB000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8EFE6000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8A800000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8A787000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8A7AA000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8A7B9000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8A7CD000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8A7E2000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8A7F2000 \SystemRoot\system32\DRIVERS\VClone.sys
  0x8A34A000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
  0x8EFFD000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8A370000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8A39A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8A3A4000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8A3B1000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8A3E6000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8E008000 \SystemRoot\system32\drivers\HdAudio.sys
  0x8E047000 \SystemRoot\system32\drivers\portcls.sys
  0x8E074000 \SystemRoot\system32\drivers\drmk.sys
  0x8E099000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8E2D0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8E2D9000 \SystemRoot\System32\Drivers\Null.SYS
  0x8E2E0000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8E2F0000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8E2F7000 \SystemRoot\System32\drivers\vga.sys
  0x8E303000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8E324000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8E32C000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8E334000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8E33F000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8E34D000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8E356000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8E36C000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8E380000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8E3B2000 \SystemRoot\system32\drivers\afd.sys
  0x8E2E7000 \SystemRoot\system32\drivers\ws2ifsl.sys
  0x8F407000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8F41D000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8F42B000 \SystemRoot\System32\Drivers\ntiomin.SYS
  0x8F42E000 \SystemRoot\System32\Drivers\ntiopnp.SYS
  0x8F436000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8F449000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8F485000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8F48F000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
  0x8F499000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8F4B0000 \SystemRoot\System32\Drivers\BTHUSB.sys
  0x8F4BD000 \SystemRoot\System32\Drivers\bthport.sys
  0x8F53D000 \SystemRoot\System32\Drivers\VMC326.sys
  0x8F578000 \SystemRoot\system32\DRIVERS\rfcomm.sys
  0x8F5A1000 \SystemRoot\system32\DRIVERS\BthEnum.sys
  0x8F5AB000 \SystemRoot\system32\DRIVERS\bthpan.sys
  0x8F5C5000 \SystemRoot\system32\drivers\btwavdt.sys
  0x8F636000 \SystemRoot\system32\drivers\btwaudio.sys
  0x8F6B6000 \SystemRoot\system32\DRIVERS\btwl2cap.sys
  0x8F6C0000 \SystemRoot\system32\DRIVERS\btwrchid.sys
  0x8F6C3000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8F6D3000 \SystemRoot\system32\DRIVERS\KMWDFILTER.sys
  0x8F6DC000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8F6E5000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8F6ED000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8F6FA000 \SystemRoot\System32\Drivers\dump_iaStor.sys
  0x81860000 \SystemRoot\System32\win32k.sys
  0x8F7D5000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8F7DF000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x81A80000 \SystemRoot\System32\TSDDD.dll
  0x81AA0000 \SystemRoot\System32\cdd.dll
  0x8AAD4000 \SystemRoot\system32\drivers\luafv.sys
  0x8F7EE000 \SystemRoot\system32\DRIVERS\kmdfmemio.sys
  0x8AAEF000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x8AAFF000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x8F7F6000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x8AB29000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x9B404000 \SystemRoot\system32\drivers\spsys.sys
  0x9B4B4000 \SystemRoot\system32\drivers\HTTP.sys
  0x9B521000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9B53E000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9B557000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9B56C000 \SystemRoot\system32\drivers\mrxdav.sys
  0x9B58D000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9B5AC000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9B5E5000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9B5FD000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9B625000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9B68C000 \SystemRoot\system32\drivers\peauth.sys
  0x9B76A000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x9B774000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x9B780000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x9B796000 \SystemRoot\system32\drivers\MSPQM.sys
  0x9B798000 \??\C:\Windows\system32\FsUsbExDisk.SYS
  0x9B7A1000 \??\C:\Windows\system32\drivers\mbam.sys
  0x772F0000 \Windows\System32\ntdll.dll

Processes (total 88):
      0 System Idle Process
      4 SYSTEM
    496 C:\Windows\System32\smss.exe
    576 csrss.exe
    640 csrss.exe
    648 C:\Windows\System32\wininit.exe
    688 C:\Windows\System32\services.exe
    712 C:\Windows\System32\winlogon.exe
    728 C:\Windows\System32\lsass.exe
    736 C:\Windows\System32\lsm.exe
    896 C:\Windows\System32\svchost.exe
    956 C:\Windows\System32\svchost.exe
    1104 C:\Windows\System32\Ati2evxx.exe
    1124 C:\Windows\System32\svchost.exe
    1152 C:\Windows\System32\svchost.exe
    1172 C:\Windows\System32\svchost.exe
    1272 C:\Windows\System32\audiodg.exe
    1304 C:\Windows\System32\svchost.exe
    1320 C:\Windows\System32\SLsvc.exe
    1388 C:\Windows\System32\svchost.exe
    1408 C:\Windows\System32\Ati2evxx.exe
    1548 C:\Windows\System32\svchost.exe
    1576 C:\Windows\System32\svchost.exe
    1836 C:\Windows\System32\spoolsv.exe
    1844 C:\Windows\System32\taskeng.exe
    1876 C:\Windows\System32\svchost.exe
    256 C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    284 C:\Windows\System32\agrsmsvc.exe
    312 C:\Windows\System32\svchost.exe
    516 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    568 C:\Windows\System32\FsUsbExService.Exe
    1404 C:\Program Files\GfK Internet-Monitor\GfK-Reporting.exe
    1456 C:\Program Files\GfK Internet-Monitor\GfK-Updater.exe
    2164 C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    2324 C:\Program Files\Nero\Update\NASvc.exe
    2348 C:\Windows\System32\svchost.exe
    2384 C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService2.exe
    2624 C:\Windows\System32\taskeng.exe
    2632 C:\Windows\System32\svchost.exe
    2644 C:\Windows\System32\svchost.exe
    2712 C:\Windows\System32\taskeng.exe
    2728 C:\Windows\System32\Rezip.exe
    2744 C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
    2768 C:\Windows\System32\dwm.exe
    2788 C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
    2796 C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
    2820 C:\Windows\explorer.exe
    2860 C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
    2872 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    2992 C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
    3008 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    3028 C:\Windows\System32\svchost.exe
    3084 C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
    3156 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    3380 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    3684 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
    3692 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    4016 C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
    4032 C:\Program Files\GfKLSPService\GfK-WatchDog.exe
    4048 C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    4068 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    4080 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    4088 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    2188 C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
    1624 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    1340 C:\Program Files\IncrediMail\Bin\IncMail.exe
    1704 C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe
    2400 C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
    2412 C:\Program Files\Windows Media Player\wmpnscfg.exe
    1832 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    2500 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    3812 C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
    1376 WmiPrvSE.exe
    2264 C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe
    2340 C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
    4120 C:\Program Files\IncrediMail\Bin\ImApp.exe
    4276 C:\Windows\servicing\TrustedInstaller.exe
    4368 C:\Program Files\Windows Media Player\wmpnetwk.exe
    4676 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    4868 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    4960 C:\Program Files\Windows Live\Contacts\wlcomm.exe
    5288 C:\Windows\System32\svchost.exe
    6216 C:\Program Files\GfKLSPService\GfKLSPService.exe
    7992 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    4396 dllhost.exe
    4348 dllhost.exe
    5020 C:\Users\Chaoskomet\Desktop\MBRCheck.exe
    4840 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`40100000  (NTFS)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000026`c5a00000  (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHM320II, Rev: 2AC101C4

      Size  Device Name          MBR Status
  --------------------------------------------
    298 GB  \\.\PhysicalDrive0  Windows 2008 MBR code detected
            SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

chaoskomet 12.07.2011 00:40
gmer hat diesmal auf den ersten mal geklappt, und das log ist:

Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-07-12 01:38:29
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AC1
Running: gvd0bmdb.exe; Driver: C:\Users\CHAOSK~1\AppData\Local\Temp\aftcypow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          C:\Windows\system32\DRIVERS\atikmdag.sys                                                            section is writeable [0x8E804000, 0x258606, 0xE8000020]

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [74347817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                [7439A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]            [7434BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]      [7433F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                [743475E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [7433E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [74378395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]    [7434DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]            [7433FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [7433FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]              [743371CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]      [743CCAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [7436C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]            [7433D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                      [74336853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [7433687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[2820] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]        [74342AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device          \Driver\BTHUSB \Device\00000070                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\BTHUSB \Device\00000070                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\BTHUSB \Device\0000006e                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device          \Driver\BTHUSB \Device\0000006e                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e276d4                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e276d8                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e2770b                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002269e279d5                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0c6076dbc066                         
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002269e276d4 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002269e276d8 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002269e2770b (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002269e279d5 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0c6076dbc066 (not active ControlSet)     

---- EOF - GMER 1.0.15 ----
so nun gehe ich noch eine rauchen, und warte mal was jetzt noch passiert.

cosinus 12.07.2011 00:45
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


chaoskomet 12.07.2011 08:34
hier der malwarescan:

Code:
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 7082

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

12.07.2011 04:58:31
mbam-log-2011-07-12 (04-58-31).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|)
Durchsuchte Objekte: 292242
Laufzeit: 3 Stunde(n), 12 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
und superantispy:


Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 07/12/2011 at 05:02 AM

Application Version : 4.55.1000

Core Rules Database Version : 7396
Trace Rules Database Version: 5208

Scan type      : Complete Scan
Total Scan Time : 03:04:46

Memory items scanned      : 876
Memory threats detected  : 0
Registry items scanned    : 10037
Registry threats detected : 0
File items scanned        : 31287
File threats detected    : 11

Adware.Tracking Cookie
        C:\Users\Chaoskomet\AppData\Roaming\Microsoft\Windows\Cookies\chaoskomet@bs.serving-sys[1].txt
        C:\Users\Chaoskomet\AppData\Roaming\Microsoft\Windows\Cookies\chaoskomet@atdmt[2].txt
        C:\Users\Chaoskomet\AppData\Roaming\Microsoft\Windows\Cookies\chaoskomet@serving-sys[1].txt
        hottraffic.nl [ C:\Users\Chaoskomet\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\YTXQRASK ]
        static1.pornturbo.com [ C:\Users\Chaoskomet\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\YTXQRASK ]
        C:\Users\Chaoskomet\AppData\Roaming\Microsoft\Windows\Cookies\Low\chaoskomet@atdmt[2].txt
        C:\Users\Chaoskomet\AppData\Roaming\Microsoft\Windows\Cookies\Low\chaoskomet@avgtechnologies.112.2o7[1].txt
        C:\Users\Chaoskomet\AppData\Roaming\Microsoft\Windows\Cookies\Low\chaoskomet@doubleclick[1].txt

Trojan.Agent/Gen-Falint
        C:\PROGRAM FILES\SAMSUNG\EASY NETWORK MANAGER\ENM.EXE
        C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\SAMSUNG\EASY NETWORK MANAGER\EASY NETWORK MANAGER.LNK
        C:\USERS\PUBLIC\DESKTOP\EASY NETWORK MANAGER.LNK
dann eset scan.

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=17b9d81b195ac4429093ad2aa4b2bb9d
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-07-08 11:43:51
# local_time=2011-07-09 01:43:51 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1032 16777213 100 85 52874 53454236 0 0
# compatibility_mode=5892 16776574 100 95 10244821 147692972 0 0
# compatibility_mode=8192 67108863 100 0 115 115 0 0
# scanned=140264
# found=0
# cleaned=0
# scan_time=8387
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=17b9d81b195ac4429093ad2aa4b2bb9d
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-07-12 04:01:09
# local_time=2011-07-12 06:01:09 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1032 16777214 0 1 13257 13257 0 0
# compatibility_mode=5892 16776574 100 100 32327 147963435 0 0
# compatibility_mode=8192 67108863 100 0 270578 270578 0 0
# scanned=141516
# found=0
# cleaned=0
# scan_time=12562

cosinus 12.07.2011 11:37
Nur Cookies und Fehlalarme bei SASW - Rechner wieder im Lot?

chaoskomet 12.07.2011 11:40
der läuft wieder scheenn fleissig - darf ich nun avg wieder installieren.

und kommt noch was?

wenn nicht dann bedanke ich mich ganz herzlich, für die gute hilfe.

kann ich das Malwarebytes weiter installiert lassen zu meinen avg und ab und zu mal durch laufen lassen?

cosinus 12.07.2011 14:01
Dann wären wir durch! :abklatsch:

Ja AVG kann wieder rauf. Du kannst auch statt AVG einen anderen Scanner nehmen, zB MSE oder Avast. Aber entweder oder, nicht mehrere gleichzeitig installieren.

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken. (Malwarebytes kollidiert nicht mit anderen Virenscannern)

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:56 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131